Audit and Assurance: Risk, Evidence and Reporting
The risk model
Audit risk = inherent risk x control risk x detection risk. Entity-level risks are assessed at planning; the auditor responds by designing substantive procedures. Detection risk is the auditor's own risk and moves inversely with the extent of testing. Materiality is professional judgement, applied at overall and performance levels.
Evidence and reporting
Assertions (occurrence, completeness, accuracy, cut-off, classification; existence, rights, valuation) drive procedure design: inspection, observation, external confirmation, recalculation, re-performance and analytical procedures. Know the ISAs on planning, risk assessment, audit evidence, going concern, subsequent events, written representations and the auditor's report. The opinion is modified (qualified, adverse or disclaimer) only for material misstatement or inability to obtain sufficient appropriate evidence.
Traps
- Emphasis of Matter and Other Matter paragraphs are not modifications of the opinion.
- A scope limitation leads to a qualified opinion or a disclaimer, never an adverse opinion.
- Completeness is tested by searching for omission, not by vouching recorded items.
- Higher control risk means more substantive testing, not less.
- Independence and quality management requirements apply throughout the engagement, not only at signing.
Worked example
An auditor cannot obtain evidence on a receivable representing 15% of total assets, with materiality at 5%. The possible effect is material but not pervasive, so a qualified opinion is issued. If the uncertainty were pervasive, a disclaimer of opinion would be appropriate.